Blog RSS Feed
Your guide to protecting the personal information of your customers from thieves, hackers, and other security threats.
It seems like every month there is another story in the news about laptops filled with hundreds of thousands of credit card numbers being lost or the identities of countless people being stolen by thieves. Previously well trusted companies have lost countless dollars in goodwill and even faced lawsuits due to carelessness and lack of security. Fortunately these types of blunders are easily avoidable with proper planning and inexpensive security measures.
The Federal Trade Commission has published a booklet titled Protecting Personal Information: A Guide for Business which explains a five step process that will significantly reduce the risk of identity theft and help you to avoid a potential public relations disaster.
The booklet identifies five key steps that businesses can take to secure personal information and offers ideas on how to implement these measures immediately.
- Take Stock – Understand what personal information your business collects and how you handle it.
In order to protect your customer’s information you first must know what you have and how it’s stored. Make a list of all of the places that you might store personal information including paper files, laptops, flash drives, cell phones, and anywhere else data might be stored. Also keep track of how you collect personal information, what information you collect, where you keep that information, and most importantly, who has access to that information.
- Scale Down – Get rid of unnecessary personal data.
Many businesses make the mistake of holding on to highly sensitive personal data that they will likely never need again. You can minimize your risk by properly disposing of old data and only holding on to what is absolutely necessary. Also, you should only collect data that is absolutely essential for meeting legal guidelines and business objectives.
- Lock It – Use tight security for storing the information that you must keep.
Keeping the personal data of your customers safe is a big responsibility and doing it correctly means you will need to implement physical and electronic security measures, along with employee training and monitoring the actions of your contractors.
Physical security measures you can take include keeping all files, CDs and other devices containing sensitive information in locked rooms or filing cabinets and limiting access to only those who absolutely must access the information. You should also consider access controls on your buildings as well as the encryption of sensitive data if you need to ship it.
Electronic security measures that you should consider include using encryption, keeping your anti-virus and anti-spyware programs up to date, and making sure your web applications are free from security leaks. You should also manage the passwords of your employees and require them to use long passwords with both letters and numbers to prevent hackers from guessing. Additionally, if your employees regularly access personal information using laptops, consider not storing any data on the machine itself and instead use a separate password protected network. That way, if a laptop is stolen, the data is still secure. Using a firewall is also incredibly important for keeping all of your computers secure from hackers.
Employee training represents a vital step in keeping customer data secure. Be sure that you run anyone who will be handling sensitive information through a background check before hiring them. Also you should limit access to personal information to only people who absolutely need it and regularly remind those employees of company security procedures. Finally, set up a system for quickly removing access to information from anyone who no longer needs access to them.
Finally, if you will be sharing any personal information with outside contractors, be sure that they have strong security practices in place. Also ask them to notify you of any security leaks that they encounter immediately.
- Pitch It – Eliminate what you no longer need.
Old documents, computers and other objects containing sensitive information must be disposed of properly. Take care to shred, burn, or pulverize any documents before throwing them away. For old computers and portable devices, simply deleting files may not be enough. Hackers have ways to find files that were technically deleted. To ensure that no one can get access to those files, use a wipe utility program before discarding the computer.
- Plan Ahead – Know how you will respond to security incidents.
While all of the above steps will significantly reduce the chances of a security breach, there is still a possibility that something might happen. Have a plan in place that addresses potential issues and designates the appropriate people that can respond to those problems.
Be sure to address all incidents immediately and know who you should contact if personal information is lost. Some of the organizations you might need to contact are law enforcement, credit bureaus, other businesses, and of course your customers. Certain states have distinct regulations for dealing with these problems so be sure to first check with your attorney.
By following these five steps you can significantly reduce your chances of facing an issue and avoid nasty lawsuits or lost goodwill from your customers. For more information, download the full Protecting Personal Information: A Guide for Business booklet.
Download this free report to learn how to measure your web effectiveness by entering your name and email address below.
